Insights

On June 5, 2026, President Trump issued National Security Presidential Memorandum (NSPM) 11 (NSPM-11) to accelerate AI adoption by the U.S. military and intelligence agencies. It directs updated AI management, acquisition, and use policies and seeks to compel AI companies to comply with Trump administration policies.  It calls for expanded training and enhanced security in collaboration with the private sector and orders the “termination for default or for convenience” of government contracts with AI companies that wish to limit how the government uses their products. NSPM-11 could also herald a major change in autonomous warfighting policy by directing the update of the Pentagon’s primary directive on autonomous weapon systems.

On May 7, 2026, the Department of War issued the long-awaited Proposed Rule to implement Section 847 of the FY 2020 National Defense Authorization Act (NDAA) regarding Foreign Ownership, Control or Influence (FOCI) requirements for contractors. The proposed rule would expand the applicability of FOCI reviews, requiring contractors and subcontractors on unclassified “covered contracts” — defense contracts and subcontracts valued in excess of $5 million that are not for commercial products and services — to submit FOCI disclosures to the Defense Counterintelligence and Security Agency (DCSA) for FOCI risk assessment (and as applicable, mitigation) as part of contract award. This would effectively require DCSA assessment and adjudication of FOCI considerations prior to contract award. Thus, both cleared and uncleared defense contractors would be subject to the rigorous DCSA disclosure requirements, scrutiny, and FOCI mitigation. Crowell discussed the Section 847 requirements in a prior alert.

On March 6, 2026, the General Services Administration (GSA) issued a significant proposed contract clause, GSAR 552.239-7001, Basic Safeguarding of Artificial Intelligence Systems (“Clause”), for inclusion in GSA Schedule solicitations and contracts for AI capabilities.  The proposed clause would impose substantial new requirements related to AI sources, intellectual property rights, data use, change management, and performance standards.  The Clause would also take precedence over any other contract terms (including commercial licensing terms) related to AI, including a Seller’s terms of sale and service to which the Government had previously agreed.  GSA requests comments by March 20, 2026.

On February 17, 2026, the Federal Acquisition Regulatory Council (FAR Council) released a Proposed Rule (Proposed Rule) to implement Section 5949(a) of the James M. Inhofe National Defense Authorization Act (NDAA) for Fiscal Year (FY) 2023 (Section 5949), following the FAR Council’s May 3, 2024 Advanced Notice of Proposed Rulemaking (ANPR).  Comments on the proposed rule are due by April 20, 2026.

The Transportation Security Administration (TSA) recently proposed an expanded role regulating unmanned aircraft systems (UAS), or drones.  On August 7, 2025, the Federal Aviation Administration (FAA) and TSA published a joint Notice of Proposed Rulemaking (proposed rule), titled Normalizing Unmanned Aircraft Systems Beyond Visual Line of Sight Operations (BVLOS).  Through this landmark proposed rule, the FAA and TSA aim to provide industry with a clear path forward for streamlined UAS operations for a variety of purposes, including package delivery, agriculture, aerial surveying, civic interest (public safety), and flight testing.  Comments on the proposed rule are due October 6, 2025.

On September 18, 2025, the Director of National Intelligence (DNI) issued the first order under the authority conferred by the Federal Acquisition Supply Chain Security Act (FASCSA), requiring exclusion and removal of products and services by an identified source.[1]

The System for Award Management (SAM, available at sam.gov) is set to incorporate Revolutionary FAR Overhaul (RFO) changes as early as the first quarter of 2026. The RFO process, which began earlier this year, will trigger matching changes to representations and certifications in SAM.gov.

On May 12, 2025, the Defense Counterintelligence and Security Agency (DCSA) released a new SF-328[1] consisting of 9 questions and 6 pages of instructions that detail the types of supporting documentation requested and identify information required by different responding entities (e.g., corporate, non-profit, academic, etc.). With this SF-328, DCSA is seeking certain frequently requested information and documents with initial SF-328 submissions rather than obtaining these documents through communications or revised SF-328 submissions. Additionally, when completed, the new SF-328 is considered Controlled Unclassified Information (CUI).

On May 7, 2025, the Defense Counterintelligence and Security Agency (DCSA or the “Agency”) announced the approval[1] of a revised and expanded Standard Form (SF) 328, Certificate Pertaining to Foreign Interests. Contractors and subcontractors engaged in work involving classified information use the SF-328 for disclosures relating to foreign ownership, control, or influence—and the form will soon be required for contractors and subcontractors in the unclassified space for certain covered contracts. Publication of the updated form has not yet occurred but is expected as soon as this weekend (May 10-11). New SF-328 forms will be required for initial and changed condition packages initiated on or after May 12 according to a National Industrial Security System (NISS) communication today.

 On November 12, 2024, the Department of Defense (DoD), General Services Administration (GSA), and National Aeronautics and Space Administration (NASA) will issue an interim rule amending FAR 52.204-7 to clarify that an offeror’s failure to maintain System for Award Management (SAM) registration during the period between proposal submission and contract award does not render the offeror ineligible for award.  Providing welcome relief to agencies and contractors alike, the interim rule requires only that an offeror be registered in SAM at the time of offer submission and at the time of contract award.

Recently, there has been a significant increase in scams targeting users of the System for Award Management (SAM.gov).  Active SAM registrations are required for federal government contractors, including to receive contracts and payments.  The non-public portions of these registrations include bank account information, tax information, and other sensitive information about a company.  Recent phishing scams and efforts to gain access to registrations indicate sophisticated actors are attempting to manipulate SAM registrations, possibly for access to payments from the government, among other reasons.  Company SAM registration Administrators should protect the company’s SAM registration from unauthorized access to the greatest extent possible.

On July 9, 2024, the CHIPS Research and Development Office released a Notice of Intent (NOI) to announce a third CHIPS Act Notice of Funding Opportunity (NOFO), which will be the first focused on the CHIPS National Advanced Packaging Manufacturing Program.  The NOFO will provide up to $1.6 billion for research and development activities in five areas of semiconductor advanced packaging, including (1) equipment, tools, processes and process integration; (2) power delivery and thermal management; (3) connector technology like photonics and radio frequency; (4) the chiplets ecosystem; and (5) co-design/electronic design automation.  The NOFO is expected to include prototype development opportunities in exemplar applications including high-performance computing and low-power systems needed for artificial intelligence.  The NOI also provides information about eligibility expectations and other anticipated requirements for applications.

On May 30, 2024, the Department of Defense (DoD) issued a final rule implementing Section 844 of the Fiscal Year (FY) 2021 National Defense Authorization Act (NDAA) and Section 854 of the FY 2024 NDAA by amending DFARS 225.7018-2 and accompanying DFARS clause 252.225-7052, which restrict DoD from acquiring certain metals and magnets from “covered countries” of Iran, North Korea, Russia, and China, to prohibit even earlier inputs in the supply chain from occurring in these countries.  Despite comments discussing the infancy of the domestic market for many “covered materials”—defined as samarium-cobalt magnets, tantalum metals and alloys, tungsten metal powder, and tungsten heavy alloy or any finished or semi-finished component containing tungsten heavy alloy—the final rule expands the restrictions on sourcing covered materials from covered countries.  Currently, the rule requires that covered materials not be melted or produced in covered countries but, effective January 1, 2027, the updated rule prohibits covered materials being mined, refined, separated, melted or produced in one of the covered countries. The expansion of the focus of the prohibition all the way back to where these materials were mined is consistent with the U.S. government’s effort to develop the domestic industrial base for and encourage on-shoring of critical minerals, magnets, and metals.   

On May 13, 2024, the Department of Defense (DoD) issued an instruction implementing policies and procedures that DoD will use to identify contractors (including uncleared contractors) requiring foreign ownership, control, and influence (FOCI) determinations, review related information, and address FOCI concerns.  These policies and procedures were put in place pursuant to Section 847 of the 2020 National Defense Authorization Act[1] (Section 847).  These FOCI requirements will, for the first time, subject many uncleared DoD contractors to rigorous disclosure requirements, scrutiny, and potential mitigation by the Defense Counterintelligence and Security Agency (DCSA). 

On May 3, 2024, the Federal Acquisition Regulation (FAR) Council issued an Advanced Notice of Proposed Rulemaking (ANPR) regarding the prohibition on semiconductors produced by certain Chinese manufacturers, enacted in Section 5949(a)(1) of the James M. Inhofe National Defense Authorization Act (NDAA) for Fiscal Year 2023 (Section 5949) expanding on the prohibition on covered telecommunications equipment and services produced by Huawei, ZTE, and others from Section 889 of the FY 2019 NDAA (Section 889).    

On April 1, 2024, the Department of Defense (DoD), General Services Administration (GSA), and the National Aeronautics and Space Administration (NASA) issued a final rule updating the Federal Acquisition Regulation (FAR) to add Part 40 on information security and supply chain security. This first action did not implement any new requirements; however, separate rulemakings will follow to relocate existing information security and supply chain security policies and procedures to the new Part 40. Additionally, new related regulations will be housed in Part 40. These actions suggest that the flow of information security and supply chain regulations is likely to continue unabated for at least the next few years.

On January 31, 2024, the Department of Defense (DoD) updated the 1260H List of entities identified as “Chinese military companies” operating in the United States, as it is required to do at least annually by Section 1260H of the National Defense Authorization Act (NDAA) for Fiscal Year (FY) 2021.  Section 1260H defines a “Chinese military company” as an entity that is:

On October 5, 2023, the Information Security Oversight Office issued Joint Notice 2024-01: Joint Ventures and Entity Eligibility Determinations (Joint Notice) with the Small Business Administration (SBA) and in coordination with the Department of Defense (DoD) to provide government contractors with additional guidance concerning joint ventures (JVs) seeking access to classified information (an Entity Eligibility Determination (EED) or Facility Clearance (FCL)).  Among other things, this Joint Notice clarifies that companies should not rely on the SBA’s regulations for the proposition that a small business JV will never need to hold an EED. 

On October 4, 2023, Deputy Attorney General (DAG) Lisa O. Monaco announced the Department of Justice’s (DOJ) new safe harbor policy for voluntary self-disclosures made in connection with mergers and acquisitions (Safe Harbor Policy).  Following other announcements from DOJ over the past two years aimed at encouraging voluntary self-disclosures, the Safe Harbor Policy was adopted because DOJ does not want to “discourage companies with effective compliance programs from lawfully acquiring companies with ineffective compliance programs.”  Through this new policy, DOJ is aiming to incentivize acquirers to timely disclose misconduct discovered during the M&A process (including pre-closing diligence and post-closing integration).

On October 5, 2023, the Federal Acquisition Regulation (FAR) Council published an interim rule to prohibit, in the performance of a government contract, the delivery or use of “covered articles” (which includes certain information technology and telecommunications equipment, hardware, systems, devices, software, and services) subject to a Federal Acquisition Supply Chain Security Act (FASCSA) exclusion or removal order.  The interim rule also imposes obligations for a related “reasonable inquiry” at the time of proposal submission and quarterly monitoring during contract performance.  These changes implement the FASCSA of 2018 (P.L. 115-390).  While the Federal Acquisition Security Council (FASC) and the order-issuing agencies (Department of Homeland Security (DHS), Department of Defense (DoD), and the Office of the Director for National Intelligence (ODNI)) have not yet issued any such FASCSA orders, those orders will be identified in the System for Award Management (SAM) or – in some cases – identified in and specific to the contract and any resulting subcontracts.